Alibaba SysOps Administrator cheat sheet

Instance families encode workload intent: g = general purpose, c = compute optimized, r = memory optimized, gn = GPU, i = local NVMe storage, e = economy/burstable.

User data runs only on first boot by default; enable 'User Data' script execution on every boot via instance metadata or Cloud Assistant for idempotent reconfiguration.

Instance metadata endpoint (100.100.100.200) exposes instance ID, region, zone, and RAM role credentials; disable public metadata access in hardened deployments.

Cloud Assistant runs commands on instances without SSH: command types Shell, PowerShell, Bat, Python; results retrievable via API/CLI for up to 30 days by default.

Custom images capture system disk only; data disk snapshots must be referenced separately when creating a multi-disk image.

Stop vs. release: stopped instances still bill for attached disks and public IPs (unless pay-by-traffic); release deletes ephemeral local disks.

Dedicated hosts and dedicated instances provide physical isolation; security groups and VPCs remain logical controls.

Instance RAM role > AccessKey on instance: role credentials rotate automatically and avoid hard-coded secrets.

VPC CIDR cannot be changed after creation; plan at least /16 with room for subnets, and avoid 100.64.0.0/10 (Alibaba reserved) and 172.16 conflicts.

Route table entries: system routes (intra-VPC, internet) vs. custom routes; a custom route to 0.0.0.0/0 via NAT Gateway enables outbound internet for private subnets.

SLB health check must point to a real path/port; unhealthy backends are removed from rotation but remain billed. Layer-4 (TCP/UDP) vs. layer-7 (HTTP/HTTPS) listeners differ in X-Forwarded-For support.

SLB access control: whitelist/blacklist per listener; internal SLB is reachable only within VPC (or via CEN/peering).

PrivateZone DNS resolves only inside associated VPCs; public DNS (Alibaba Cloud DNS) is authoritative for internet-facing zones.

VPN Gateway (IPsec) and Express Connect (physical) are the two main hybrid connectivity options; CEN interconnects VPCs across regions/accounts.

Security group rules are stateful; NACL (network ACL) is stateless and evaluated before security groups - allow both directions in NACL.

Elastic IP can be bound to ECS or SLB; unbound EIPs incur idle charges.

OSS storage classes: Standard, IA, Archive, Cold Archive, Deep Cold Archive; retrieval fees and minimum storage durations apply (IA 30 days, Archive 60, Cold 180, Deep Cold 180).

OSS versioning + lifecycle rules enable object recovery and cost control; delete markers count toward storage.

OSS bucket ACLs: private, public-read, public-read-write; default is private - never set public-read-write on production buckets.

NAS protocols: NFS (Linux) and SMB (Windows); performance tiers (Capacity, Performance) and mount targets are per-VPC.

ESSD PL0/PL1/PL2/PL3 differ in IOPS and throughput; PL-X is required for high-IOPS databases.

Automatic snapshot policy applies to system and data disks; snapshots are incremental and stored in OSS-backed snapshot service.

Hybrid Backup Recovery (HBR) backs up ECS files, NAS, OSS, and on-prem; restore granularity depends on backup plan.

OSS cross-region replication (CRR) requires versioning enabled on source and destination buckets.

RAM policy evaluation: explicit Deny > explicit Allow > implicit Deny; resource-level policies can be attached to users, groups, or roles.

STS temporary credentials have a max session duration (default 3600s, configurable up to 12h) and are the correct mechanism for federated or cross-account access.

Security group default behavior: all inbound denied, all outbound allowed; rules reference CIDR or other security group IDs.

SSL certificates can be uploaded to or issued by Alibaba Cloud Certificate Management Service and bound to SLB/ALB/CDN; expiry monitoring is a CloudMonitor event.

RAM role for ECS uses instance metadata to deliver rotating STS tokens; never store AccessKeys in user data or code.

ActionTrail records API calls (management events) and can deliver to OSS/Log Service for audit retention.

KMS manages encryption keys for OSS, ECS disks, and RDS; envelope encryption uses a CMK per resource.

RAM password policy and MFA enforcement are account-level settings; root account should have MFA and no AccessKeys.

CloudMonitor metrics have namespace per service (acs_ecs_dashboard, acs_slb_dashboard, acs_oss_dashboard); default agent metrics include CPU, memory, disk usage (requires CloudMonitor agent).

Alarm rules: metric + threshold + comparison + consecutive periods + silence period; notifications via contact groups, webhook, or MNS.

Event alarms (system events) cover ECS state changes, OSS bucket policy changes, and security group changes.

Log Service (SLS): Logstore + Logtail agent or SDK/API ingestion; indexes must be created before querying.

SLS alerts support query-based conditions and can trigger webhooks/Function Compute; retention is per-Logstore.

CloudMonitor agent must be installed for memory/disk/process metrics; hypervisor metrics (CPU, network) are available without it.

Dashboard and application groups aggregate metrics across instances for operational views.

Metric retention: CloudMonitor keeps raw metrics for a limited window (typically 31 days for 1-minute data); archive to SLS for long-term.

ROS template sections: ROSTemplateFormatVersion, Parameters, Mappings, Conditions, Resources, Outputs; resources declare Type, Properties, and optional DependsOn.

ROS stack operations: Create, Update (with change sets), Delete; rollback on failure can be enabled per stack.

Cloud Assistant command execution via aliyun CLI: aliyun ecs RunCommand --InstanceId.1 i-xxx --CommandContent ...; poll with DescribeInvocationResults.

Alibaba Cloud CLI uses profiles (~/.aliyun/config.json); aliyun configure sets AccessKey, region, and output format.

Terraform Alibaba Cloud provider (alicloud) mirrors ROS capabilities; state should be remote (OSS backend) for team use.

Resource Orchestration Service supports stack groups and templates for multi-account/multi-region rollout.

OpenAPI uses signature v3 (ACS3-HMAC-SHA256) for most services; SDKs handle signing automatically.

Cloud Assistant can be triggered by OOS (Operation Orchestration Service) for patching and runbooks.

Multi-zone deployment: place ECS in at least two zones behind SLB; SLB health checks remove failed zone backends.

Auto Scaling: scaling group + scaling configuration + rules (target tracking, scheduled, or step); cooldown prevents thrash.

RTO/RPO drive DR strategy: backup/restore (hours), pilot light, warm standby, multi-site active-active.

OSS CRR + versioning gives cross-region object durability; RDS cross-region backup or DTS replication for databases.

SLB supports multi-zone (primary + backup zone) for the load balancer itself, not just backends.

Database high availability: RDS primary/standby with automatic failover; PolarDB uses shared storage with read replicas.

Chaos engineering via ChaosBlade or Alibaba Cloud Chaos (AHAS) validates failover assumptions.

DNS failover (Alibaba Cloud DNS health checks + failover routing) can redirect traffic across regions.

Cannot SSH: check security group inbound 22, instance status, VNC console, and whether public IP/EIP is attached or NAT is used.

SLB 502/504: backend health check failing or backend slow; verify port, path, and security group allowing SLB health check source.

High CPU on ECS: use CloudMonitor + top/atop via Cloud Assistant; check for runaway processes or crypto-mining (common after credential leak).

Disk full: identify with df -h and du; snapshots do not free space - resize disk or clean logs; extend filesystem after resizing.

Network unreachable across VPCs: verify route tables, security groups, and whether peering/CEN is attached to both VPCs.

OSS 403: check bucket policy, RAM policy, and whether request uses signed URL with correct expiry.

Use ActionTrail + SLS to correlate change events with incidents; enable CloudMonitor event alarms for state changes.

Tag resources (env, owner, cost-center) to support cost allocation and blast-radius analysis during incidents.